SFS D / SF 3

Back to SFS D

Status: Question model review passed; solution and completed SF authoring pending.

This is a generated authoring draft. Human approval and operational assessment results have not been supplied.

Question

Has documented evidence been maintained throughout the review period confirming that all security policy exceptions were formally approved by designated authorities with defined review intervals and revocation conditions?

Plain-language explanation

Model-reviewed question draft. Completed explanations and a canonical solution are pending. The proposed positive criterion is: Documented exception approvals with review intervals and revocation terms exist for all granted exceptions

Assessment criterion and evidence

Actor: Organization. Scope: Security policy exception management process. Evidence period: Review period. Required evidence: Formal exception approval records signed by designated authorities; Specified review intervals for ongoing exceptions; Documented revocation conditions and procedures. Negative criterion: No evidence of approved exceptions or missing required review/revocation terms. Missing evidence: Pending until documented exception records are provided

View the JSON record (opens in a new tab).

Assessment result: unset.